CVE-2025-43964 is a low severity memory safety bug in LibRaw, the C++ library many photo tools use to read camera raw files. Versions before 0.21.4 are affected. The fix shipped in LibRaw 0.21.4, so upgrade the library, or the application that bundles it.
What's affected
- Product: LibRaw, the raw image decoding library.
- Affected: versions before 0.21.4.
- Fixed version: 0.21.4, published on 13 April 2025 per the LibRaw release note.
- Location:
decoders/load_mfbacks.cpp, in tag 0x412 processing in phase_one_correct, which does not enforce minimum w0 and w1 values. - Severity: CVSS 2.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), rated Low. The vector is local with high attack complexity, and the only impact scored is availability.
How to check if you're exposed
LibRaw reaches your systems three ways: as a system package, as a build dependency of an application, or bundled inside another package. Check all three.
# system library
ldconfig -p | grep -i libraw
dpkg -l | grep -i libraw # Debian and Ubuntu
rpm -qa | grep -i libraw # Fedora, RHEL and similar
# Python wheels that bundle LibRaw
pip show rawpy
For rawpy and similar wheels, the bundled LibRaw version depends on the wheel build, so read the package release notes. Distribution security trackers also record which package revision carries the fix, since Debian and others may backport the patch without changing the version number. Check your vendor tracker if the version looks old.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Upgrade LibRaw to 0.21.4 or later, or install your distribution's updated package.
- Rebuild and redeploy any application that statically links LibRaw or bundles it in a wheel, a container image or a desktop package.
- Until the update lands, avoid opening raw files from unknown sources in tools that use LibRaw, and keep thumbnailing services away from untrusted uploads.
- If you run an upload pipeline that decodes raw photos, run the decoder in a sandbox with limited memory and no network access.
- Add LibRaw to your software inventory so the next advisory is easy to match.
Why it matters
The weakness is CWE-1284, improper validation of a specified quantity in input. The decoder reads values from the file, such as tag data, and uses them to index into buffers without confirming that the access stays inside the buffer. A crafted camera file can steer the read outside the intended bounds.
The rating is Low because the vector is local, the attack complexity is high and the only impact scored is availability. It still belongs in your patch cycle, because LibRaw sits deep in image tools, gallery software and upload pipelines, where it processes files from outside the organisation. The same 0.21.4 release fixes several related checks in the Phase One and Fujifilm code, so one upgrade covers this CVE and its neighbours. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Quick check
Which version fixes this?
LibRaw 0.21.4. The release note lists the added checks in the Phase One tag handling and the Fujifilm 0xf00c tag parser.
Does an application that uses LibRaw need an update too?
If it bundles or statically links LibRaw, yes. Ask the vendor or rebuild against 0.21.4 or newer.
Sources
Last reviewed: 18 October 2026.
